Threat actors have leveraged the new Gh0stGambit dropper to distribute the Gh0st RAT malware in drive-by download attacks against Chinese Windows users, The Hacker News reports. Malicious Google Chrome-spoofing installer packages hosted on a fraudulent Chrome website facilitated the deployment of a legitimate Chrome setup executable and a trojanized installer that loads Gh0stGambit, which then verifies active security software before fetching Gh0st RAT, an eSentire analysis revealed.

Source: SC Magazine